Fluid Attacks Database

Description

Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of binary data.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
alpine v3.2	openssl	>=0 <1.0.2h-r0	1.0.2h-r0
alpine v3.3	openssl	>=0 <1.0.2h-r0	1.0.2h-r0
alpine v3.4	openssl	>=0 <1.0.2h-r0	1.0.2h-r0
alpine v3.5	openssl	>=0 <1.0.2h-r0	1.0.2h-r0
alpine v3.7	openssl	>=0 <1.0.2h-r0	1.0.2h-r0
debian 12	openssl	>=0 <1.0.2h-1	1.0.2h-1
alpine v3.6	openssl	>=0 <1.0.2h-r0	1.0.2h-r0
alpine v3.8	openssl	>=0 <1.0.2h-r0	1.0.2h-r0
debian 14	openssl	>=0 <1.0.2h-1	1.0.2h-1
debian 13	openssl	>=0 <1.0.2h-1	1.0.2h-1

1-10 of 18

Aliases

References

1. https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf2. https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=5b814481f3573fa9677f3a31ee51322e2a22ee6a3. http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html4. http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html5. http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html6. http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html7. http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.